What Is a Data Retention Policy?

A data retention policy is a formal document containing guidelines on how a business handles data.’ This policy is different for each business. For your business, this document should answer these four questions:  

• What personal data does the business hold?
• What is the purpose behind it?
• For what duration does the business need to keep it?
• What happens to the data after its holding period?

With the help of a data retention policy, a Data Fiduciary can establish clear rules for how long the organisation will store the data before deleting it. This helps the fiduciary to stay aligned with principles of limiting data collection and retention periods.

What is Retention Under DPDP Act?

Under the DPDP Act, data retention is the legal duty of Data Fiduciaries to store personal data only as long as necessary to fulfill different purposes for which the data was collected. Once data serves its purpose or when the consent is withdrawn, the company must delete it.

When should Personal Data be Erased?

Under Section 8(7) of the DPDP Act, a Data Fiduciary must erase personal data when it can be safely assumed that the intended purpose has been fulfilled, or when the individual to whom the data is related to (Data Principal) withdraws consent; whichever is earlier. The only exception is when another law requires you to keep the data.

The erasure of data is like this:

Data Collection Usage (acc. to purpose) Kept until needed Erase when purpose ends.

What is Rule 8 for Data Retention and Erasure?

Rule 8 under the DPDP Rules 2025, gives timelines for when a business should delete the data and when it can retain the data.

The following are the main data retention and erasure rules. Your business’ data retention policy should be built around these points:

The Three-Year Inactivity Rule (Third Schedule)

Many businesses think the DPDP Rules fix a three-year retention limit for everyone. But it is not applicable to everyone.

Under the DPDP Rules, large platforms must delete a user’s personal data after three years of complete inactivity or lack of interaction. These large platforms are:

If you are one of the above platforms, and a user has not interacted with you for three years, you need to start the erasure process. 

If you are not one of the platforms stated above, you cannot rely on the three year rule. The general Section 8(7) rule still applies to you, that is, keep data only while the purpose lasts.

The 48-Hour Notice [Rule 8(2)]

Business cannot delete the user data just because user is inactive . Rule 8(2) says that the user must receive a warning at least 48 hours before their data is deleted. 

The notice of warning should tell the user that their data will be deleted unless they log in to their account or contact you. If they respond, deletion does not go ahead.

It is recommended that the warning be given through different mediums (SMS, email). You could also keep a timestamp record for every notice you issue. 

Minimum Log Retention Period [Rule 8(3)]

The fiduciaries must keep the personal data, related traffic data, and logs of processing for at least one year from the date of processing. After that, fiduciaries must erase them, unless another law (RBI, SEBI, or other Act) requires data retention.

Even if a Data Principal asks to delete all of their data, logs may serve as evidence if the Data Protection Board investigates. Logs provide privacy, security, and legal readiness.

Legal Exceptions 

Businesses can retain data even after the original purpose is fulfilled or consent is withdrawn, if other laws require it, like the Companies Act, 2013,  the CGST Act, 2017, RBI, and other applicable laws.

How Long Can You Keep Personal Data Under DPDP Act?

Under the DPDP Act, there is no specific single retention period for personal data. Instead, the data must be deleted as soon as the specified collection purpose is fulfilled or the consent by the Data Principal is withdrawn.  

Still, these are some of the specific timelines under the DPDP Rules:

• 1 Year –  The access logs and processing records must be kept for one year. It is the minimum time period for retention. 
• 3 Years – Some specific large digital platforms must delete the user’s data if they are inactive for 3 years.
• 7 Years – Consent Managers must store complete audit trails of all consent events, when the consent was given, modified, or withdrawn—for a minimum of 7 years.

A business can follow this data deletion process:

1. What data do you hold, and why? Connect each data type to its purpose.
2. Who has the data? List all processors and systems.
3. When should it be deleted? Apply the right trigger and period.
4. How will you verify it? Ask for proof of deletion from third parties.

What should a data retention policy include?

A data retention policy for any business should define: 

Company’s Objectives

State the reasons for storing the data. It should cover the legal, regulatory, and operational requirements.

Systems and Records

Specify all the databases, systems, and physical records where personal data could be stored. 

Risk-based data classification

A risk-based profiling is needed because not all data carries the same risk, so it shouldn’t be kept for the same length of time.

Retention Timeline

A retention schedule turns your policy into simple, practical rules. It states exactly how long each type of data is kept and when it must be deleted. It aligns the timeline with different rules. 

Data Ownership 

It tells about who is responsible for each set of data. With clear ownership, it is easy to decide how long data is kept, when it should be deleted, and whether the retention rules are actually being followed.

Storage Locations

Listing where data is throughout servers, cloud, backups, emails, or devices helps to confirm whether the data is deleted once the retention period ends.

Legal Data Holding

The policy should define if any law mandates it to keep it past its retention period. 

Deletion Process

Clear steps to show who deletes the data, how it is erased, and how the deletion is recorded. It helps in proving compliance.

Deletion for any business needs to be a repeating cycle, not a one-time cleanup. Find your data, sort it, set periods, watch for triggers, delete, and keep proof. Below are the common mistakes to avoid while deleting the data:

• Keeping data forever. 
• Treating three years as a baseline rule. 
• Deleting logs too early.
• Forgetting backups and old systems.
• Leaving processors out. 
• Having a policy but no process. 

Getting this wrong can be costly. Under the DPDP Act, you can be fined up to ₹250 crore if you fail to put reasonable security safeguards in place. The stored data that is not in use also brings threats like breaches.  

Build a Data Retention Policy with DPDP.ai

Drafting a retention policy is easy, but following it every day is the hard part. This is where DPDP.ai steps in.

DPDP.ai helps you put retention rules into practice by automating data discovery, consent-to-purpose mapping, and deletion workflows. It finds personal data across your systems, links each record to its purpose, and sets a retention period. 

It also supports Rule 8, including the 48-hour deletion notice, the three-year inactivity rule, and one-year log retention. 

With DPDP.ai deletion runs on schedule, and every action is recorded, giving you clear proof of compliance.

Conclusion

Under the DPDP Act, retention depends on purpose, not storage. Keep personal data till the real purpose or legal duty tells you to and delete it when that ends. 

Rule 8 adds the details: a 48-hour deletion notice, a three-year inactivity period for large platforms, and one-year log retention.

To follow the retention laws, businesses must map data, set retention periods, and build deletion into their systems. A clear policy, backed by a working process, protects users and gives you proof of compliance.

FAQs

Ques: What is the data retention period under the DPDP Act?

Ans: There is no fixed retention period for all personal data under the DPDP Act. The retention period depends on its purpose fulfillment. The minimum is one year for logs, and the three-year rule applies only to large platforms.

Ques: How is personal data deleted under the DPDP Act?

Ans: Personal data should be erased when its purpose is completed or consent is withdrawn by the individual. The only exception is when the law requires you to keep the data.

Ques: What is the data retention three-year rule?

Ans: According to Rule 8(1), it is a rule that is applied only to certain large e-commerce, online gaming, and social media platforms. This rule says that these platforms must delete user personal data if the user is inactive for three years continuously.

Ques: Do companies keep logs even after a deletion request?

Ans: Yes, most of the time. Companies keep system logs, audit trails, and compliance records. The companies keep it even if a Data Principal has submitted a formal deletion request.

Ques: Do data processors have to delete personal data?

Ans: Yes. Data Processors must also delete personal data. They have to delete personal data, when instructed by the data fiduciary. They also need to delete it when the contract between them ends.

Ques: What is a data retention and deletion policy?

Ans: It is a policy that discloses for how long any organisation will keep personal data in their systems and how the data will be erased securely after its purpose is served or consent is withdrawn by the individual to whom the personal data is related to (data principal).

Ques: What does the data retention policy in India require?

Ans: Under the DPDP Act, data must be erased when consent is withdrawn or the purpose is served. The only exception is unless any law requires it to be kept.

The post Data Retention Policy under DPDP Act: What Enterprises Must Know to Stay Compliant appeared first on DPDP.ai.

The DPDP Act does not use the term PIA, but Section 10(2)(c) requires Significant Data Fiduciaries to conduct periodic DPIAs. However, the accountability and obligations for SDFs (Significant Data Fiduciaries) make privacy impact assessments essential. In this guide, you will get to know when you need a PIA and how it differs from a DPIA.

What is a Privacy Impact Assessment?

A Privacy Impact Assessment (PIA) is a structured process for identifying privacy risks arising from the collection, use, storage, or sharing of personal data. Organizations use PIAs to improve risk management, demonstrate accountability, and improve individual trust.

Under the DPDP Act, a DPIA (Data Protection Impact Assessment) is used, which a Significant Data Fiduciary must conduct. PIA is a broader governance tool compared to the DPIA, a specific regulatory requirement assessment.

Is a Privacy Impact Assessment Mandatory Under the DPDP Act?

Not for every business. Under the DPDP framework, only Significant Data Fiduciaries (SDFs) must carry out a Data Protection Impact Assessment (DPIA). 

Once a company is notified as an SDF, Rule 13 requires it to complete a DPIA and an audit once every 12 months, counted from the date of notification.

When do these Obligations Apply?

These SDF duties under Rule 13 begin on 13 May 2027. A Data Fiduciary becomes an SDF only when the Central Government notifies it, based on factors such as the volume and sensitivity of data processed and risk to Data Principal rights. Beyond the DPIA, an SDF must also appoint an India-based Data Protection Officer who reports to its Board, and an independent data auditor. Under Rule 13 of the DPDP Rules, an SDF must conduct a DPIA and an audit once every 12 months, counted from the date it is notified.

How to Conduct a Privacy Impact Assessment?

Here is the workflow for conducting a PIA best-practice workflow aligned to Rule 13:

• Map the processing activities: Identify what personal data is collected, how it is processed, where it is stored, and who accesses it.

• Define the Purpose: Clearly document why the personal data is being collected and processed.

• Assess Potential Harm: Identify and check possible risks or harm to Data Principals arising from the processing.

• Assess Data Risks: Weigh factors such as the volume and sensitivity of the personal data and how processing could affect individuals.

• Identify Safeguards: D
  ocument the technical and organizational measures used to manage and reduce identified risks.

• Assess Algorithm Risks: Where relevant, review any algorithmic software used in processing to confirm it does not put Data Principals’ rights at risk.

• Document the findings: Record of processing activities, purposes, identified risks, risk reduction measures, and significant observations.

• Review Annually: Rule 13 of the DPDP Rules, 2025 requires the person carrying out the DPIA and audit to send the Data Protection Board a report of their significant observations. Others should reassess when products, vendors, or data types change.

DPDP DPIA Vs GDPR PIA

What are the common mistakes to avoid?

• Treating the DPIA as a one-time exercise rather than an ongoing process.
• Mapping only core systems and missing vendors, processors, and shadow IT.
• Skipping the algorithmic risk review
• Recording findings without an owner or a deadline
• Confusing a security audit with a D
  PIA. A security audit checks controls, while a DPIA assesses risk to Data Principals’ rights.

Conclusion

PIA (privacy risk assessment) is a structure to identify the risks that can occur due to failure in data protection. The DPDP Act does not use the PIA; instead, it uses DPIA Data Protection Impact Assessment). According to DPDP, a Significant Data Fiduciary must conduct a DPIA annually and also submit a report to the Data Protection Board. Apart from SDF. An SDF can follow a structured DPIA workflow to streamline the process, or use DPIA tools to automate it.

FAQs

Ques: Why does the DPDP Act require a DPIA?

Ans: A Privacy Impact Assessment (PIA) is a systematic process for identifying privacy risks before or during the processing of personal data. It helps businesses protect personal data and avoid penalties.

Ques: Is it mandatory to conduct a PIA in India?

Ans: The DPDP Act makes a DPIA, not a PIA, the mandatory requirement for Significant Data Fiduciaries. A Data Protection Impact Assessment should be conducted by an SDF (Significant Data Fiduciary). However, a PIA can be conducted by Data Fiduciaries for data protection.

Ques: How does a DPIA differ from a PIA?

Ans: A PIA is a broader privacy risk approach. Whereas DPIA is a specific data protection assessment required under certain privacy laws. DPIA is used under the DPDP framework.

Ques: Does every Data Fiduciary have to carry out a DPIA?

Ans: No, only the SDFs are required to conduct a DPIA under the DPDP  Act.

Ques: How frequently must an SDF carry out a DPIA?

Ans: Under Rule 13 of the DPDP Rules, 2025, an SDF is required to conduct a DPIA every 12 months.

The post Privacy Impact Assessment Under India’s DPDP Act: What It Is and How to Conduct One appeared first on DPDP.ai.

Hackers use leaked data for fraud, phishing, and identity theft. A breach can’t be undone, and the customer pays for it. 

PII discovery fixes this issue as personally identifiable information (PII) is scattered across your systems. With PII Discover tools, you can secure customers’ personal data before someone uses it. PII Discovery is also the foundational step for complying with India’s Digital Personal Data Protection (DPDP) Act.

In this guide, we explain what PII discovery is, how it works, and why it matters for your business.

What is PII Discovery?

PII Discovery means Personally Identifiable Information Discovery. It is a process of finding personal data through the whole system of any business. With a PII Discovery tool, the data discovery becomes an automatic process of scanning a business’s whole digital system. After data’s discovery comes locating and categorizing any sensitive personal data. 

In simpler words, PII is any data that can be used to identify, contact, or find a single person. It is basically like a digital footprint for an individual. 

With the introduction of the DPDP Act, protecting personal data has become the primary objective for companies. So if your business wants to protect personal data, you need to locate where that personal data is, throughout your whole organisation. 

PII can be classified into two categories:

Direct Identifiers: They are the labels (identifiers) that can precisely identify you. The examples for Direct Identifiers are: A person’s full name, government identification numbers, contact information, account and financial identifiers, and biometric information.

Indirect Identifiers: These are the labels (identifiers) that are less unique and do not identify you precisely. But when combined together, they can precisely identify you. The examples for Indirect Identifiers are: Date of birth, gender, IP address, device IDs, browser cookies, geolocation data, and behavioral data.

PII Data Discovery Helps In Finding Sensitive Data

PII Discovery helps businesses to locate personal data across databases, cloud apps, files, APIs, and AI tools. A PII Data Discovery tool automatically scans all of the places where personal data sits and tells you what you have. 

It turns hidden personal data into a clear organised list. This helps you to secure the data, reduce breach risks, and prove compliance.

This is how it helps:

• It scans through all your structured and unstructured databases, files, PDFs or any other source. This also includes the forgotten data that sits in your systems.
• This scan helps you in spotting details like names, phone numbers, email IDs, Aadhaar, PAN, and more. It then sorts personal data by type and risk.
• Classification helps in labelling each data by type and sensitivity.
• The sensitive data is then marked with high, medium, or low risk levels. 
• It shows you how data moves throughout your whole system and third-parties.
• The actions above help in catching issues like missing consent records, unencrypted PII, weak access controls, and data kept longer than needed.
• As databases change daily, it runs continuous scans and adds or updates new PII as it appears.
• Regular scans throughout your whole system help you manage data efficiently and find gaps in data handling. 
• These findings make audits easier and make you compliant with laws like DPDP Act and GDPR. 

PII Data Discovery Helps In Protecting Sensitive Data

After knowing where personal data lives on your systems, you can then protect it. PII Data Discovery tool gives you visibility of your whole system. Then every other security step depends on. 

This is how it protects:

• As data is located and classified, you now know which data is sensitive and where it sits.
• It labels the data into high, medium and low risk data to help you secure the most exposed and risky data first.
• It exposes weak spots like unencrypted PII and loose controls over data so you can fix them before they lead to a breach.
• The continuous scans help in finding old, duplicate, changed or forgotten data so you can manage those data easily. 
• Data flow maps show where PII travels across systems and vendors so you can spot risky transfers. 
• During a breach, you already know what data was affected, which makes reporting within deadlines much easier.  
• Clear data handling gives clear records and audits that show regulators that you handle data responsibly.

Why Is PII Data Discovery Important Now?

PII Data Discovery is the first step to manage massive datasets and to be compliant with privacy laws. 

After the introduction of the DPDP Act, individual privacy has given more importance. The DPDP Act has real deadlines and non-compliance is not an option for businesses. The DPDP Act was formally notified in 2023 giving businesses up to 18 months to comply with the set guidelines under the Act. 

The PII Data Discovery has become suddenly urgent because of these strict compliance requirements under the DPDP framework:

• In case of any violation, the organisation is liable to pay penalties of up to ₹250 crore, for failing to keep reasonable security safeguards. There are other violations with different penalties as well. To mitigate this, you need to know what data you hold and where. 
• In case of a data breach, a Data Fiduciary must inform the Data Protection Board of India and the affected individuals without delay, and send a detailed report to the Board within 72 hours. Without PII data discovery and classification tools, it is impossible to instantly identify which user records were compromised.
• The Act grants special powers to individuals (Data Principals). The organisations must be prepared when the Data Principals want to know about their personal data (The Right to Access) or if they want to erase their data (The Right to Erasure) from the organisation. If you don’t know where your customer’s data lives, how would you fulfill their request?
• According to the Act, the data can only be used for the exact reason it was collected for and after that purpose is served, the data must be deleted. PII Discovery helps you with finding the data that has overstayed its purpose fulfillment. 

DPDP.ai Helps Businesses With A Dedicated PII Discovery Tool

The DPDP Act is drafted to specifically protect digital personal data and brings non-compliance and penalties if not followed. 

As PII Discovery is the basic step towards protecting digital personal data, a PII Discovery tool helps a business by replacing slow manual audits with continuous, AI-driven scanning for both structured and unstructured systems.

This is how DPDP.ai’s PII Discovery tool helps a business:

• The tool scans databases, cloud apps, files, and AI pipelines. 
• It ranks every data set as high, medium, or low risk.
• It creates a visual chart of how data moves across your systems.
• It also keeps observing your systems and alerts you to anything new or changes. 
• It maps each finding to DPDP Act, GDPR, HIPAA, PCI DSS, SOC 2, and ISO 27001 requirements.
• It points out compliance gaps with a score and timelines.
• This tool doesn’t need installation, just connect your data sources and tool starts. 

Conclusion

PII discovery means finding the personal information your business holds, such as names, phone numbers, email addresses, ID numbers, and bank details. Privacy laws like the DPDP Act and GDPR require organisations to protect this data.

You cannot secure data if you don’t know where the data is. Once you find it, you can decide who can see it, keep it safe, and follow the law.

Personal data often hides in old files, emails, and cloud apps. If it is forgotten, it can be lost or stolen. A leak can cost money, hurt your reputation, and break customer trust.

Your data keeps changing, so doing PII discovery and classification once is not enough. Check your data regularly to keep it safe.

FAQs

Ques: What is Personally Identifiable Information?

Ans: Personally identifiable information (PII) is any detail that can point to a specific person, either on its own or when combined with other details.

Ques: What is PII and examples?

Ans: PII stands for Personally Identifiable Information. It is any data that can be used to directly or indirectly identify a single individual. Examples of PII are: full legal name, passport number, date of birth, IP address etc.

Ques: What is PII Discovery?

Ans: Personally Identifiable Information Discovery is an automatic process of scanning, finding, and classifying a user’s personal information. This data discovery is done across an organization’s digital storage and applications. 

Ques: What is PII Classification?

Ans: After finding the data through PII Discovery, PII Classification is the next step. It is the process of sorting data into groups based on how sensitive it is.  

Ques: What is not an example of PII?

Ans: Any data that cannot identify an individual is not a PII. Generic data and anonymous information are not considered Personally Identifiable Information (PII). The examples for this are: your pet’s name, your first name only, your favorite show name, etc.

Ques: Why is PII discovery important under the DPDP Act?

Ans: The DPDP Act requires you to protect personal data, delete it when it is no longer needed, and answer user requests. You can’t do any of this if you don’t know where the data is.

The post What Is PII Discovery? How it helps in Finding and Protecting Sensitive Data appeared first on DPDP.ai.

The Data Principal is the individual whose data is processed, while the Data Fiduciary determines why and how personal data is collected and processed.

Often, the Fiduciary brings outside partners that help them to automate workflows, run systems, or handle the data processing. According to the Act, these partners are called Data Processors. 

Under the DPDP Act, A Data Processor is any entity that processes digital personal data for a Data Fiduciary. A cloud hosting provider, third-party payroll firms, and external customer support are examples of data processors.

Read ahead to know about Data Processor’s roles, duties, and regulations. 

Who is a Data Processor under the DPDP Act, 2023?

Under Section 2(k) of the DPDP Act 2023, a Data Processor means “any person who processes personal data on behalf of a Data Fiduciary.”

A Data Processor is any person, corporation, association of persons, or any organization handling the personal data for a data fiduciary. It has no independent decision-making power over the data. It executes the operations or tasks based entirely on the documented instructions and terms provided by the Data Fiduciary.

What are the Obligations and Rules for a Data Processor under the DPDP Act?

The Data Processors only carry direct contractual obligations and shared operational responsibilities.

The DPDP Act puts almost all the duties on the Data Fiduciary. A Data Processor is bound only through the contract, but the fiduciary becomes fully liable for processor’s activities under Section 8(1,2).

Data Processor’s Obligations and Responsibilities:

A valid contract 

According to Section 8(2), a data fiduciary can engage a processor only under a valid contract. A fiduciary engaging, appointing, using or involving any data processor to process personal data on its behalf can only do so under a valid contract. This valid contract is known as Data Processing Agreements (DPAs).

Security Safeguards 

The Data Fiduciary has the duty to safeguard the personal data of an individual, and this duty carries down to the Data Processor as well.

Under Section 8(5) of the DPDP Act, 2023, the Data Fiduciary must take reasonable security safeguards to prevent a data breach, including for processing done by its Data Processor. The processor is bound to these safeguards through its contract. 

Now according to DPDP Rules, 2025, a Data Fiduciary (and any Data Processor working for it) must put these safeguards in place:

Rule 6 (1)(a) – Protect the data – Use encryption, masking, obfuscation, or tokens that are used instead of the real personal data.

Rule 6 (1)(b) – Control access – Limit access to the systems and computers that handle the data.

Rule 6 (1)(c) – Visibility on Accessing – Maintain logs and regularly review the data so unauthorised access can be spotted, investigated, and prevented from happening again.

Rule 6 (1)(d) – Have Backups – If the data is destroyed, lost, or compromised, the processing can be continued through backups.

Rule 6 (1)(e) – Retain logs for one year – Keep the personal data for at least one year to help detection, investigation, remediation, and recovery. The time period can be different under the compliance of another law.  

Rule 6 (1)(f) – Appropriate requirements in the contract – Add reasonable security requirements in the contract between the Data Fiduciary and the Data Processor

Rule 6 (1)(g) – Use technical and organisational measures: Make sure the safeguards are actually followed in practice.

Breach Handling 

In case of a data breach, the processor must immediately tell the fiduciary, as required by their contract. The fiduciary must then inform affected Data Principals and the Board without delay, and send the Board a detailed report within 72 hours. [Under Section 8(6) and Rule 7]

Erasure 

When the individual’s consent is withdrawn or its purpose is served, the fiduciary must ensure the processor also erases the data. [Under Section 8(7-b) and Rule 8]

How Do Data Processors Stay Compliant under the DPDP Act?

As a Data Processor handles personal data on behalf of a Data Fiduciary. The act puts a legal responsibility on the fiduciary only and not on the processor even if the processor does the work. So the processor stays compliant mainly by meeting the terms of its contract (presented by fiduciary) which the Act, 2023 and the DPDP Rules, 2025 shape.

Following is the Data Processor compliance checklist:

• Sign a valid legal contract with the fiduciary before handling any data – Section 8(2)
• Use data only for the fiduciary’s purpose and stop when told to – Section 6(6)
• Apply security safeguards like encryption or masking, access controls, activity logs and monitoring – Section 8(5), Rule 6
• Keep logs and data for at least one year – Rule 6
• Report breaches to the fiduciary quickly so it can notify the Board and affected individuals – Section 8(6)
• Erase data when the fiduciary asks – Section 8(7)(b)
• Follow cross-border transfer limits set by the Government – Section 16

Why Data Processors Can’t Ignore DPDP Compliance?

According to Section 8(1), the Data Fiduciary remains legally responsible if any data processor fails. If reasonable security safeguards are not in place, even because of the processor, the fiduciary can face a penalty of up to ₹250 crore. 

In practice, Data Fiduciaries who appoint Data processors make Data Processing Agreements to manage risk by writing security and breach obligations into the contracts. Through these contracts, if a processor fails to comply may face contractual claims.  

Conclusion 

A Data Processor handles personal data only on behalf of a Data Fiduciary. It has no authority to decide the purpose or means of processing. The Section 8(1) and 8(5) puts the pressure on the fiduciary for protecting personal data, even when a processor handles it. 

But this doesn’t mean that the processor doesn’t have any particular responsibility. The processor’s duties are laid out in the Data Processing Agreements and contracts. 

Violating security guidelines can cost the fiduciary up to ₹250 crore in penalties, so fiduciaries have every reason to choose compliant processors. Clear contracts, strong security and quick breach reporting make a processor a safer partner for fiduciaries. 

FAQs

Ques: Is Data Fiduciary and a Data Processor the same?

Ans: No, they are not the same. A Data Fiduciary determines the means and purpose of processing personal data. A Data Processor only processes it on behalf of a fiduciary.

Ques: What does data processor do?

Ans: A Data Processor manages and processes data for a Data Fiduciary based strictly on their orders.

Ques: Why does a Data Processor need a contract to work for a Data Fiduciary?

Ans: Section 8(2) says a fiduciary can engage a processor only under a valid contract.

Ques: What are the roles and responsibilities of a data processor?

Ans: A Data Processor processes personal data on behalf of a Data Fiduciary. This processing is done under the fiduciary’s instructions and contract. It does not decide why or how the data is used.

Ques: What are the obligations of data processors under the DPDP Act?

Ans: The DPDP Act places the main duties on the Data Fiduciary only. A processor’s work is limited through the contract between processor and fiduciary.

Ques: What are the compliance requirements for Data Processors?

Ans: A processor should have a valid contract with the fiduciary, and follow Rule 6 of DPDP Act 2025 to have safeguards like encryption, access controls, monitoring, backups. It should also keep record for at least one year, help report breaches, and erase data when the fiduciary asks.

Ques: What is the difference between data controller vs data processor?

Ans: Data Controller is the same as Data Fiduciary. While under the GDPR law, Data Controller is used and under DPDP Act, Data Fiduciary is used. A data controller (fiduciary) decides why and how personal data is processed, while a data processor handles it only on the controller’s behalf and instructions. 

The post Data Processor Under the DPDP Act, 2023: Meaning, Obligations & Compliance Checklist appeared first on DPDP.ai.

What is Vendor Risk Management Under the DPDP Act?

Vendor risk management is the process of identifying, checking, controlling, and monitoring risk.

Generally, vendor ecosystems include:

• Cloud and Hosting providers
• Payroll and HR Platform
• CRM Provider
• Customer support vendors
• Marketing platforms
• IT Service providers
• Analytics Providers

What are Key Vendor Management Risks?

These are the risks a vendor must check:

• Unauthorized Data Access: A vendor may expose personal data to employees, contractors, or systems that do not require access.

• Excessive Data Sharing: Sharing more personal data of data principal can increase the risk of a security and privacy incident.

• Security Weakness: Weak authentication, inadequate access controls, poor vulnerability management, and insufficient monitoring can increase exposure.

• Subprocessor Risk: A vendor may rely on additional service providers, creating another layer of third party risk that needs to be checked.

• Data Retention: Personal data may remain with a vendor longer than necessary if retention and deletion requirements are not cleary established.

• Incident Response: Delayed notification or poor coordination during a personal data breach can make incident management more difficult.

Who is responsible when a vendor handles personal data?

Under Section 8 (1) of the DPDP Act, the data fiduciary is responsible for compliance even if the compliance issue occurs with the Data Processor or vendor. This means a contract saying “the vendor is responsible for privacy compliance” does not by itself, transfer the organization’s statutory responsibility.

What are the essential DPDP Act provisions for vendors?

What Should a DPDP Vendor Contract Include?

A vendor contract should contain privacy and security expectations as clear contractual obligations:

Scope of Purpose and Processing

A data fiduciary should define the services being provided and how the vendor is permitted to process personal data.

Data Security

Depending on the risk, contractual requirements may address:

• Access controls
• Authentication
• Encryption
• Security Monitoring
• Vulnerability management
• Incident Response

Confidentiality

Personnel who have access to personal data should be subject to appropriate confidentiality obligations.

Personal Data Breach Management

The agreement should clearly mention how incidents are reported and escalated, including:

• Notifications procedures
• Required incident information
• Investigation support
• Containment and remediation
• Evidence and audit trails

Subprocessors

Organizations should also define how subprocessors are identified, approved, monitored, and managed when they have access to personal information.

Retention and Deletion

Contracts should establish expectations for retaining, returning, or deleting personal data when the processing purpose or contractual relationship ends.

Audit and Assurance

For higher-risk vendors, organisations may require appropriate assurance evidence, such as security assessment reports, certifications, questionnaires, or audit rights.

Risk-Based Vendor Classification

Not every vendor requires the same level of scrutiny:

Low Risk

Vendors with no personal data access or very limited exposure may require:

• Basic due diligence
• Standard contractual requirements
• Periodic review

Medium Risk

Vendors processing limited personal data and supporting important business functions may require:

• Detailed Due Diligence
• Privacy and security assessment
• Specific contractual control
• Periodic reassessment

High Risk

Vendors handling large volume of personal data supporting essential systems, or having access, may need:

• Enhanced due diligence
• Detailed security assessment
• Strong contractual safeguards
• Assurance evidence
• More frequent monitoring
• Formal remediation tracking

Ongoing Vendor Monitoring

Vendor risk should be reviewed throughout the relationship instead of during onboarding only. Monitoring may include:

Periodic privacy and security assessments

• Changes in processing activities
• New Subprocessors
• Security Incidents
• Material changes to the vendor’s environment
• Contract renewals
• Data Retention practices
• Business continuity considerations

What happens if a Vendor Experiences a Personal Data Breach?

If a data breach occurs, the vendor must inform the data fiduciary as soon as possible. It should assess the breach, conduct an impact assessment, and work with the vendor to investigate and remediate the incident.

Under the DPDP Rules, 2025, the Data Fiduciary must notify the affected Data Principal and the Data Protection Board within 72 hours. After the breach, the organisation should review the vendor’s security measures and take steps to prevent the same issue from happening again.

What are the common vendor risk management mistakes?

A Data Fiduciary should avoid the following mistake to reduce compliance issue:

• Treating the Contract as the Entire Compliance Programme

Contractual protections are important, but they need to be supported by operational and security controls.

• Conducting Due Diligence Only Once

Vendor risk can change because of new subprocessors, services, systems, incidents, or ownership changes.

• Giving Vendors Excessive Access

Vendor access should be limited to the data and systems required for the agreed service.

• Failing to Plan for Offboarding

Vendor exit procedures should cover the data return and deletion, access revocation, credentials, integrations, and other relevant closure activities.

• Applying the Same Controls to Every Vendor

A risk-based approach allows organizations to apply stronger controls to vendors that create greater privacy or security exposure.

Conclusion

Third-party vendors can create privacy and security risks if they are not properly managed. Businesses should follow a risk-based process that covers due diligence, access controls, monitoring, breach response, and offboarding. Vendor risk management helps data fiduciaries protect personal data while supporting practical and effective DPDP compliance. Following the laws and compiling DPDP compliance is necessary.

FAQs

Ques: What is Vendor risk management?

Ans: Vendor risk management refers to the structured process of identifying, assessing, monitoring, and managing third-party risk. It covers cybersecurity, privacy, regulatory, operational, financial, and compliance risk.

Ques: What are the 5 stages of risk management?

Ans: Generally, the 5 stages of risk management are:

Risk identification, risk assessment, risk treatment, risk monitoring, and risk reporting/review.

Ques: What happens to personal data held by a vendor when a Data Principal withdraws consent?

Ans: If the consent is withdrawn, it is a duty of the data fiduciary to ensure the data principal’s information is deleted from both the fiduciary and processor systems.

Ques: How soon must a personal data breach involving a vendor be reported under the DPDP Act?

Ans: It should be reported within 72 hours of the breach and 6 hours to cert in.

Ques: Does the DPDP Act require organizations to enter into a Data Processing Agreement (DPA) with vendors?

Ans: DPDP Act Section 8(2) requires a Data Fiduciary to engage with a Data Processor for relevant processing only under a valid contract.

Ques: Who is responsible for a personal data breach caused by a Data Processor?

Ans: Data Fiduciary is the responsible entity for compliance under Section 8 of the DPDP Act.

The post Vendor Risk Management Under the DPDP Act: A Practical Guide for Indian Businesses appeared first on DPDP.ai.

If a person wants to know what information a business has about them, they can make a DSAR (Data Subject Access Request).

For businesses, handling a request can involve checking the person’s identity, searching different systems for their information, reviewing the records, protecting other people’s information, and securely sending the response. Here in this blog, you will learn about the DSAR full form and what it means in different regulations.

What is a DSAR full form?

DSAR full form is Data Subject Access Request. Through this a person can ask a company to tell them what personal details it holds about them and what it is doing with that information.

For example, an online retailer can store your name, contact details, purchase history, support conversations, marketing preferences, and other personal information across different systems.

It allows you to request access to relevant information, subject to the privacy law that applies. The rules and rights may be different in each country. For example, the UK GDPR uses “data subject” while India’s DPDP Act refers to individuals as Data Principal.

What Is the Difference Between DSAR, DSR and SAR?

All these terms look similar, but they are not completely the same:

The terminology matters less than the specific right being exercised and the law that applies to the organization and individual.

What Can Someone Request Through a DSAR?

Because regulations differ by country, there is no single answer that applies everywhere. 

In general, an individual may seek information such as:

• Personal information held about them
• Details about how their data is used
• Purpose of processing the personal information
• Information about recipients or third parties
• Relevant retention information
• Other supplementary information required by the applicable law

Under the UK GDPR, for example, the right of access includes confirmation that personal information is being processed, a copy of the personal information and supplementary information.

Data Subject Access Requests under GDPR

The GDPR provides a right of access under Article 15.

The right includes confirmation of whether personal data concerning the individual is being processed and, where applicable, access to that personal data and specified supplementary information.

The supplementary information may include:

• Reason behind the processing
• Categories of personal data
• Recipients or categories of recipients
• Retention-related information
• Information about the individual’s rights
• Information about the source of the data where applicable

GDPR also requires communications concerning data subjects’ rights to be provided in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. So, organizations need clear rules and steps to handle these requests.

Data Subject Access Requests Under India’s DPDP Act

India’s Privacy framework uses different terminology. The Digital Personal Data Protection Act, 2023 refers to individuals as Data Principals and organizations as Data Fiduciaries.

This means organizations can use “DSAR” as an operational term, but should use the DPDP Act’s terms (Data Principal, Data Fiduciary) in legal and customer-facing communication.

Rights of Data Principals: Sections 11 to 14 of the DPDP Act give Data Principals four main rights: access to information about their data (Section 11), correction and erasure (Section 12), grievance redressal (Section 13), and nomination of another person to act on their behalf (Section 14). The Act does not use the term “DSAR,” but these rights are how such requests work in practice.

What is the Data Subject Access Request response timeline?

There is no single worldwide DSAR deadline.

The applicable deadline depends on the privacy law and circumstances of the request.

For example, under the current ICO guidance for UK GDPR subject access requests, organizations generally need to respond without undue delay and within one month. In certain complex cases, or where multiple requests have been made by the same person, the period can be extended by up to two additional months.

Organizations should therefore avoid creating a universal internal rule such as:

Instead, the workflow should determine

• Which law applies
• When did the relevant clock start
• Is identity verification required?
• Is clarification reasonably necessary?
• Does the applicable law permit extension?

When can the organization refuse or request?

A DSAR does not always result in unrestricted disclosure:

Depending on the applicable law, an organization may be able to withhold certain information or restrict access in specific circumstances.

Examples include:

• Information relating to another person
• Legal professional privilege
• Certain regulatory or legal restrictions
• Crime- and taxation-related circumstances 
• Confidential information

How does DSAR Software help?

A dedicated DSAR software helps businesses centralize the operational work involved in handling access requests. From receiving access requests, corrections, erasures, and more, you can manage everything from one place with an audit trail. This reduces manual workload and compliance issues.

FAQs

Ques: What is the DSAR full form?

Ans: It stands for Data Subject Access Request.

Ques: What is a data subject access request?

Ans: A DSAR is a request that allows people to understand what data companies collect, how they use it, and who they share it with. It focuses on access. Correction and deletion are usually handled as separate data subject requests (DSRs), although many organizations process them through the same workflow

Ques: What is the difference between DSAR and DSR?

Ans: A DSAR is a request to access the personal data an organization holds about you. A DSR is the broader category that covers access, correction, deletion, restriction, and other privacy-rights requests, so every DSAR is a DSR, but not every DSR is a DSAR.

Ques: Can third-party vendors hold data covered by a DSAR?

Ans: Yes, organizations may store personal data with cloud providers, payment processors, analytics services, and other vendors. So when an organization gets a DSAR from an individual, it has to gather the relevant data to that individual from all its third-party vendors as well. 

Ques: Can Parents or guardians submit a Data Subject Access Requests for a child?

Ans: Yes, Under the DPDP Act, parents or lawful guardians can exercise data rights on behalf of children, subject to the nature of the request and identity verification.

The post What Is a DSAR (Data Subject Access Request)? Meaning, Rights & Timeline appeared first on DPDP.ai.

This guide clears that up. It explains what a consent manager is under the DPDP Act, exactly how one gets registered with the Data Protection Board, the obligations it must meet once registered, and the question most businesses actually care about: whether you need to become one or simply work with one.

Everything below is grounded in the letter of the DPDP Rules, 2025, specifically Rule 4 and the First Schedule. Where it matters, the relevant clause is named so you can verify it yourself.

What is a consent manager under DPDP Act?

A Consent Manager is a company registered with the Data Protection Board of India that gives people a single, interoperable platform to give, manage, review, and withdraw their consent for how their personal data is processed. It sits between the individual (the Data Principal) and the businesses that use their data (the Data Fiduciaries), and it is legally bound to act in the individual’s interest, not the businesses’, through a fiduciary duty defined in the DPDP Rules.

Two features make it unusual. First, it is a regulated entity: not just anyone can call themselves a consent manager. It must be an Indian company with a net worth of at least ₹2 crore and must be registered with the Board. Second, it is deliberately built to be “blind.” The rules require that consent and data pass through its platform in a form the Consent Manager itself cannot read.

That is the whole concept in a paragraph. The rest of this article unpacks each part.

Consent Manager vs. Consent Management System: an important distinction

Before going further, it is worth killing a common mix-up, because it trips up even experienced privacy teams.

• A Consent Manager (capital C, capital M) is the legal role created by the DPDP Act: a board-registered company acting as a neutral, interoperable consent intermediary.
• A consent management system, or consent management platform (CMP), is the software a business uses to capture, store, and honor consent for its own data processing.

Every data fiduciary needs some form of consent management capability to comply with the Act. Very few businesses will ever become a registered consent manager. Buying or building a consent management platform does not make you a consent manager, and you do not need to register with the board simply to manage consent for your own users. Keep this distinction in mind, because the rest of this guide uses “Consent Manager” strictly in its legal sense.

Where the Consent Manager fits in the DPDP ecosystem

The DPDP Act works with a small cast of defined players:

• Data Principal: the individual whose personal data is being processed (you and me).
• Data Fiduciary: the entity that decides why and how personal data is processed (a bank, a hospital, an e-commerce app).
• Data Processor: an entity that processes data on a fiduciary’s behalf.
• Consent Manager: the registered intermediary that lets the Data Principal control consent across many Fiduciaries from one place.

Think of the Consent Manager as a single dashboard for your consents. Instead of every app maintaining its own opaque consent settings buried three menus deep, a Data Principal can go to one trusted platform, see every business that holds a consent from them, and grant or withdraw it there. When consent is withdrawn, the instruction flows back to the relevant fiduciary.

If that architecture sounds familiar to anyone in Indian fintech, it should. It is conceptually close to the Account Aggregator model, where a regulated, consent-driven intermediary moves information between institutions without reading or retaining it. The consent manager generalizes that idea across the whole economy, not just financial data.

How a Consent Manager actually works: a real-world example

The easiest way to get this is to walk through a situation you have probably lived through.

Say you are applying for a personal loan. The lender needs to see your bank statement to check your income. Normally that means digging out a PDF, or worse, handing over your net-banking login to some aggregator you have never heard of. With a consent manager in the picture, it looks different.

You are already a user on a Consent Manager’s app; call it your consent dashboard. The lender is onboarded there too. When they need your statement, a request lands in your dashboard: “[Lender] wants to access your account statement for loan assessment.” You see exactly who is asking, for what, and for how long. You tap approve, and your bank sends the statement straight to the lender. The consent and the instruction to share both flow through the Consent Manager’s platform.

Here is the part that matters: the consent manager never sees your statement. The rules are explicit that data has to pass through in a form the consent manager cannot read. It is carrying a sealed envelope from your bank to the lender. It routes it and logs that it happened but never opens it.

And because every one of these approvals is recorded in one place, you can open your dashboard six months later, see that the lender still has standing access, and revoke it in a couple of taps. No hunting through email, no calling a helpline. That is the whole promise: your consents, visible and reversible, from a single screen.

Who can become a consent manager? Registration conditions under the DPDP Rules

This is where a lot of businesses realise the consent manager role is not for them, and that is by design. Part A of the First Schedule to the DPDP Rules, 2025, sets a deliberately high bar. To be eligible, an applicant must satisfy conditions including:

1. It is a company incorporated in India. Not an LLP, not a foreign entity, not an individual.
2. It has sufficient technical, operational, and financial capacity to meet its obligations.
3. Its financial condition and the general character of its management are sound.
4. Its net worth is not less than ₹2 crore.
5. Its capital structure and earning prospects are adequate for the volume of business expected.
6. Its directors, key managerial personnel, and senior management have a reputation and record of fairness and integrity.
7. Its constitutional documents (MoA and AoA) lock in the key fiduciary and conflict-of-interest obligations, changeable only with the Board’s prior approval.
8. Its proposed operations are in the interest of data principals.
9. It is independently certified that its interoperable consent platform meets the data-protection standards and assurance framework the Board publishes and that appropriate technical and organisational measures are in place.

Read together, these conditions signal the Board’s intent: a Consent Manager should look less like a startup shipping an MVP and more like a small, well-capitalised, independently audited financial-market infrastructure. That is a feature, not a bug. The whole model depends on data principals being able to trust these intermediaries completely.

How the registration process works: Rule 4 step by step

Rule 4 of the DPDP Rules governs the mechanics. The flow is straightforward:

• Application (Rule 4(1)). An eligible company applies to the Data Protection Board, furnishing the particulars, information, and documents the Board specifies on its website.
• Inquiry and decision (Rule 4(2)). The Board may make any inquiry it sees fit to confirm the applicant meets Part A. If satisfied, it registers the company, informs it, and publishes the Consent Manager’s particulars on its website. If not satisfied, it rejects the application and communicates the reasons.
• Ongoing obligations (Rule 4(3)). Once registered, the Consent Manager must meet the obligations in Part B of the First Schedule (covered below).
• Direction to remediate (Rule 4(4)). If the Board believes a Consent Manager is not adhering to its conditions or obligations, it must give the company an opportunity of being heard, then inform it of the non-adherence and direct it to fix the issue.
• Suspension or cancellation (Rule 4(5)). If the Board considers it necessary in the interest of data principles, it may, again after a hearing and for reasons recorded in writing, suspend or cancel the registration and issue whatever directions it deems fit to protect data principles.
• Power to call for information (Rule 4(6)). The Board can require a consent manager to furnish any information it calls for.

Notice the pattern: the Board leans toward remediation before punishment, and every adverse action carries a hearing and a written-reasons requirement. That procedural fairness is baked in.

The obligations of a registered Consent Manager

Registration is the start, not the finish. Part B of the First Schedule lays out the standing duties. The most consequential ones:

Enable full consent lifecycle control. The platform must let a data principal give, manage, review, and withdraw consent, whether directly to a fiduciary or routed through another onboarded fiduciary.

Stay blind to the data. As covered above, the manner of sharing must ensure the contents are not readable by the consent manager.

Keep a complete, portable record. The consent manager must record every consent given, denied, or withdrawn; the notices that accompanied each consent request; and every instance of data sharing with a transferee fiduciary. It must give the Data Principal access to this record, provide it in machine-readable form on request, and retain it for at least seven years (or longer, if law or agreement requires).

Run a real website or app. The rules require a website or app (or both) as the primary way data principals reach the service. The Consent Manager cannot be a back-office API with no front door for individuals.

No subcontracting. A consent manager cannot subcontract or assign its obligations under the Act and Rules. The buck stops with the registered entity.

Act as a fiduciary. It must act in a fiduciary capacity toward the Data Principal, a legal standard of loyalty, meaning the individual’s interest comes first.

Avoid conflicts of interest. It must actively avoid conflicts with data fiduciaries, including through its promoters and key personnel, and put measures in place so that directorships, financial interests, employment, or beneficial ownership in fiduciaries do not compromise its neutrality.

Be transparent about ownership. It must publish, accessibly, details of its promoters, directors, KMP, and senior management; anyone holding more than 2% of its shares; related body-corporate shareholdings; and anything else the Board directs in the interest of transparency.

Submit to audit. It must maintain effective audit mechanisms and report outcomes to the Board, covering its technical and organizational controls, its continued fulfillment of registration conditions, and its adherence to the Act and Rules.

Get board approval to change control. Control of the company cannot be transferred by sale, merger, or otherwise without the Board’s prior approval.

Taken together, these obligations are what turn a “consent app” into a trusted piece of public infrastructure.

Do you need to become a Consent Manager, or just work with one?

For the vast majority of businesses reading this, the honest answer is, “You don’t need to become one.”

If you are a bank, an insurer, a hospital, an e-commerce platform, a lender, or any other business that collects personal data to serve your own customers, you are a data fiduciary. Your obligation under the DPDP Act is to obtain valid consent, honor withdrawals, secure the data, and meet the notice and rights requirements. You can do all of that with a consent management platform of your own. You do not need to register with the Board as a Consent Manager to run your own consent flows.

Becoming a registered consent manager only makes sense if your actual business is to be the neutral, interoperable consent intermediary for others, a distinct commercial model with the ₹2 crore net-worth floor, independent certification, no-sub-contracting rule, and audit obligations that come with it.

So the practical question for most teams is not “How do we register as a consent manager?” It is “how do we make our own consent management DPDP-ready?” capturing granular, purpose-specific consent, storing an auditable record, and making withdrawal as easy as granting. That is a software and process problem, and it is solvable today.

Conclusion

The Consent Manager is one of the more forward-looking ideas in the DPDP framework: a regulated, blind, fiduciary intermediary that hands control of consent back to individuals and makes it portable across the businesses they deal with. It is a high-bar role, Indian incorporation, ₹2 crore net worth, independent certification, seven-year records, audits, and board oversight, and it is not something most companies will, or should, become.

What every data fiduciary does needs is consent management; it can stand behind when the board comes asking: granular, purpose-bound, fully logged, and easy to withdraw. Getting that right is the real DPDP consent task in front of most Indian businesses today.

FAQs

Ques: Is a consent manager the same as a consent management platform (CMP)?

Ans: No. A consent manager is a board-registered company performing a defined legal role under the DPDP Act. A consent management platform is software a business uses to manage consent for its own processing. You can run a CMP without ever being a consent manager.

Ques: What is the minimum net worth to register as a consent manager?

Ans: Under Part A of the First Schedule to the DPDP Rules, 2025, the applicant’s net worth must be not less than ₹2 crore, along with other technical, operational, financial, and integrity conditions.

Ques: How long must a consent manager keep consent records?

Ans: At least seven years, or longer if the Data Principal and Consent Manager agree or if another law requires it. The record must also be available to the data principal in machine-readable form on request.

Ques: Can a consent manager read the personal data flowing through it?

Ans: No. The rules require that data be shared in a manner that is not readable by the consent manager. It facilitates the movement of data and consent without accessing the contents.

Ques: Who registers and regulates consent managers?

Ans: The Data Protection Board of India. It grants registration under Rule 4, can direct a consent manager to remediate non-compliance, and can suspend or cancel registration, always after a hearing and with written reasons.

Ques: Does every business need to appoint or use a consent manager?

Ans: No. Data principals may choose to use a consent manager, but the Act does not force every data fiduciary to route consent through one. Businesses still carry their own consent obligations regardless.

(This article is for general informational purposes and reflects the DPDP Act, 2023, and the DPDP Rules, 2025, as published. It is not legal advice; for how these obligations apply to your specific business, consult a qualified data-protection professional.)

The post Consent Manager Under the DPDP Act: Role, Registration & How It Works appeared first on DPDP.ai.

What Is a Data Fiduciary? (Data Fiduciary Meaning)

A Data Fiduciary is the person or organization that decides why personal data be collected or used, and how that data should be processed. (Under Section 2 (i) of DPDP Act)

In simple words, if your organization decides why personal data is being collected and how it is processed, you are the Data Fiduciary regardless of who actually performs the technical processing.

Who Qualifies as Data Fiduciary?

Anyone can qualify as a Data Fiduciary if:

• Individuals or Organizations that decide why and how personal data will be processed
• Companies and businesses processing customer, employees, or users’ personal data.
• Government departments or authorities when they determine the purposes and means of processing.
• Entities processing data jointly, where they collectively determine the purpose and means of processing.
• These entities may use a Data Processor to handle personal data, but they remain responsible for ensuring compliance with the law.

Example of Data Fiduciaries

E-commerce Company

An online shopping company collects customer names, addresses, and purchase details to deliver orders and provide offers. Since the platform decides why and

how data is going to be used, it is a Data Fiduciary. 

Employer

A company collects employees’ bank details, identification information, and attendance records for payroll and HR purposes. The company is the Data Fiduciary, while the payroll service provider may act as a Data Processor.

Key Obligations of a Data Fiduciary Under the DPDP Act

Data Fiduciary is required to handle personal data in a lawful, transparent, and secure manner. The key obligations are:

Lawful Processing (Section 4)

• Personal data of an individual should be processed only for a lawful purpose.
• The business must obtain the person’s consent and must have a legitimate reason to get it.
• Legitimate uses may include voluntary provision of data, delivery of state benefits, compliance with legal obligations, medical emergencies, employment-related purposes, and situations involving disaster or public order.

Provide Clear Notice (Section 5)

You should show clear notices to the person:

• What personal data is being collected
• Purpose of processing
• How Data Principals can use their rights
• How compliance can be made with the Data Protection Board

The notice must be provided in English or a language included in the Eighth Schedule, as applicable.

Notice should be provided before or along with the request for consent or, in the case of consent obtained before the Act, as soon as reasonably practicable.

Obtain and Manage Valid Consent (Section 6)

• Consent must be given freely and clearly, with full understanding of what it is for. Consent requests should use simple and easy-to-understand language.
• It must provide relevant contact details, including those of the Data Protection Officer (DPO), where applicable.
• Data Principals must be able to withdraw consent
• Following withdrawal, the Data Fiduciary and its Data Processors must cease processing within a reasonable time, unless another lawful basis for processing applies.
• It must show that the person was properly informed and gave consent.

Remain Accountable for Processing – Section 8

Remain responsible for compliance even when using a Data Processor and engage processors only through a valid contract.

• Ensure completeness, accuracy, and consistency of personal data where required
• Keep personal data safe by using proper security measures and prevent data breaches. If a data breach occurs, the Data Fiduciary must notify the affected individual and the Data Protection Board.
• Erase personal data when consent is withdrawn, or the purpose is no longer served, unless retention is legally required
• Share the DPO’s or contact person’s details.
• Provide an effective grievance redressal mechanism.

Children’s Data – (Section 9)

They need provide additional protection to children’s:

• Obtain verifiable parental consent
• Avoid processing data that can harm child well-being
• Not undertake tracking and behavioural monitoring
• Not use targeted advertising directed at children

Significant Data Fiduciary – (Section 10)

Significant Data Fiduciaries (SDFs) have some extra responsibilities. They are required to appoint an independent data auditor and a DPO based in India.

 They must regularly check how they handle personal data and carry out audits. The DPO must report to the Board of Directors or a similar senior body.

What are the Penalties of Non-Compliance for Data Fiduciaries?

If the data fiduciary fail to comply with the regulation it may face the potential listed below:

Conclusion

Data Fiduciary refers to the person, organization and joint businesses that decide the purpose of collecting information of a person or data principal. The DPDP Act imposes mandatory obligations that a fiduciary must follow, including lawful processing, clear notice, and obtaining and managing valid consent. Failure to follow the DPDP obligations may bring penalties to businesses, along with losing customer trust and reputational damage.

FAQs

Ques: What does Data Fiduciary mean?

Ans: In simple terms, it is the person or organization that decides why and how personal data is collected or processed under the DPDP Act.

Ques: What is the difference between a data fiduciary and a data principal?

Ans: It’s the person or entity that collects the personal information, while a Data Principal is the person whose data is collected.

Ques: Is a Data Processor the same as a Data Fiduciary?

Ans: No, a Data Processor and a Data Fiduciary are not the same. Data Processor processes data as a third party, where the fiduciary determines the processing and purpose.

Ques: Does every Data Fiduciary need to appoint a Data Protection Officer (DPO)?

Ans: No, only significant data fiduciaries have to appoint a data protection officer.

The post Data Fiduciary Under DPDP Act: Meaning, Duties & Penalties appeared first on DPDP.ai.

Section 10(2)(c) of Digital Personal Data Protection Act, 2023 makes the DPIAs a mandatory compliance tool for Significant Data Fiduciaries (SDFs) as certain organisations are engaged in high-risk data processing.

For more information regarding DPIA under the DPDP Act, read along.

What is DPIA Full Form?

The full form for DPIA is Data Protection Impact Assessment. So what does DPIA stand for in practice? DPIA is a privacy risk assessment that is done to identify and diminish the potential privacy risks. It is a crucial part of demonstrating compliance with privacy regulations such as GDPR and the DPDP Act.

A regular compliance audit examines what has already been done whereas a DPIA is conducted before a new processing activity, system change, or a product launch. This allows the organisations to establish different strategies to mitigate those risks. DPIA is genuine evidence to prove that your organisation is working to alleviate privacy risks.

Under the DPDP Act, a DPIA is not automatically required for every organisation, it is applicable for-

Significant Data Fiduciaries (SDFs): Under Section 10(2)(c) of the DPDP Act, organisations that are classified as SDFs must conduct DPIAs and a data protection audit once every twelve months.

Government Announcement: Special categories and sectors identified by the central government or the Data Protection Board of India (DPBI).

Are DPIAs Necessary?

DPIAs are an essential part of a company’s obligations. Conducting a DPIA is a legal requirement for any company processing high-risk data. If a company fails to conduct DPIAs under the DPDP Act, it faces severe regulatory penalties, financial liabilities, and operational risks. Companies failing to conduct a DPIA and periodic audits can attract penalties of up to ₹150 crore.

In April 2024, Indian electronics brand boAt’s customer records were exposed via unpatched infrastructure. Names, addresses, emails, and phone numbers of over 7.5 million customers were leaked on the dark web. The cause for this breach is an unpatched, poorly monitored framework that holds large volumes of customer personal information.

This is exactly what a DPIA is meant to catch. This assessment requires an organisation to map:

Exactly where personal data lives
Evaluate the security controls around each system
Flag outdated or unmonitored infrastructure

So, are DPIAs necessary? Yes, they are. A breach like boAt’s was not a structured attack, it was a known category of risk that went unassessed. A DPIA checks the risks so the organisation can fix it. It turns “we didn’t check here” into “we already checked, and fixed it.”

What are the key components of a DPDP DPIA Report?

A DPIA under the DPDP Act is a systematic process that Significant Data Fiduciaries (SDFs) are required to carry out to identify, evaluate, and mitigate privacy risks before undertaking high-risk data processing activities. A well-structured DPIA report typically includes the following components:

1. Data Processing Identification – A clear report about what data is collected, what is its purpose, and how it will be used.
2. Risk Assessment – An evaluation and analysis of potential risks to privacy for Data Principals. This assessment helps in catching problems before they turn to real breaches.
3. Safeguard Strategies – Implement mitigation methods like encryption, pseudonymization, and anonymization to reduce risks. After identifying the risks, this is where they are reduced.
4. Legal Compliance – Confirming that the processing activity is in compliance with laws and regulations under the DPDP Act.
5. Documentation – Maintaining a record of the entire assessment for accountability and transparency with stakeholders and regulatory authorities.
6. Regular Monitoring – Periodic review and updating DPIAs as technologies, regulations, and business operations advance with time.

Who Needs to Conduct DPIAs?

Conducting a Data Protection Impact Assessment (DPIA) once every 12 months is legally mandatory only for Significant Data Fiduciaries (SDFs) that are designated by the Central Government. An organisation does not choose that status. These are the bodies that need to conduct DPIAs-

Significant Data Fiduciaries (SDFs)

Under Section 10 of the DPDP Act, only the bodies that are notified to be ‘significant’ by the government are legally required to conduct annual DPIAs. An organisation becomes significant based on factors such as:

The volume and sensitivity of personal data processed;
risk to the rights of Data Principal;
potential impact on the sovereignty and integrity of India;
risk to electoral democracy;
security of the State; and
public order

Third-Party Involvement

Even if an organisation hasn’t been officially notified as an SDF, its partners, banks, insurers, or hospitals often require third-party vendors and contractors to complete a DPIA as part of private business compliance.

High-Risk Sectors Where DPIAs Are Strongly Advisable

In sectors that deal with sensitive data or high-risk activities, conducting a DPIA is considered best practice, even without an SDF notification. These sectors are:

• Banking and Fintech
• Healthcare and Health-Tech
• Social Media and Online Platforms
• E-Commerce and Retail

Is a DPIA the Same as a Data Audit?

No they are not the same, they fulfill different functions, happen at different times, and present different outcomes.

DPIA (Data Protection Impact Assessment)

• Primary Function – It identifies and evaluates risks to Data Principals before starting a high-risk processing activity.
• Timing – It is conducted before launching a new product, feature, or processing activity.
• Focus – What could go wrong, and how could we prevent it?
• Result – DPIA brings a risk report with mitigation strategies to reduce potential risks.
• Who does it – It is mandatory for Significant Data Fiduciaries (SDFs) under the DPDP Act.

Data Audit

• Primary Function – It is done to review and verify the existing data handling practices to check compliance with laws, policies, and internal standards.
• Timing – It is conducted after data processing is already in place and on a scheduled basis.
• Focus – Are we following the rules properly and doing what we said we’d do?
• Result – An audit brings a compliance report highlighting gaps, violations, or if any area needs correction.
• Who does it – Any organisation handling personal data.

Many organisations use both together — a DPIA when introducing something new, and regular data audits to make sure ongoing practices stay compliant over time.

The DPIA Deadline Is Coming – Is Your Company Ready?

The DPIA is not in full force yet, but the time is closer than most companies realise.

The DPDP Act and its rules were officially notified on 13 November 2025, but it is still rolling out in phases, and they are –

• Phase 1 (November 2025): The Data Protection Board of India (DPBI) was formally established, along with foundational provisions.
• Phase 2 (November 2026): Registration and obligations for Consent Managers.
• Phase 3 (13 May 2027): Complete enforcement of all remaining statutory obligations and rules. This includes the DPIA requirement for Significant Data Fiduciaries, breach reporting duties, and enforcement of security safeguards with penalties of up to ₹250 crore.

So technically, the DPIA mandate isn’t enforceable today. But May 2027 is closer than it feels, and DPIAs aren’t something you can build overnight. They require mapping your entire data, assessing risk across systems, documenting safeguards, and getting sign-off. This process would easily take months, not weeks.

How DPDP.ai Helps You Manage DPIAs

Running DPIAs manually across different systems is exactly why most organisations struggle to stay on top of privacy risk. This unorganised data hides risks. There are delays caused by manual reviews. Also, bringing compliance evidence from scattered systems is very slow.

This is where DPDP.ai solves this by bringing DPIAs into one connected platform. The platform offers-

• Ready-made templates.
• Expert-guided steps to help you finish assessments faster.
• Automatic alerts when your data or processes change.
• Single dashboard to track risks and approvals across teams.
• One-click reports ready to show regulators.

Conclusion

A Data Protection Impact Assessment (DPIA) under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) is a mandatory compliance tool which is used to recognise, evaluate, and reduce privacy risks and harms to individuals before launching high-risk data processing activities. DPIAs help the organisations to skip potential data breaches, financial penalties and losing customer trust.

While the full enforcement is phased until May 2027, waiting for that deadline isn’t smart; it is a risk. Companies that start mapping their data, assess risks, and build safeguards will be ahead of breaches, regulations, and competition.

FAQs

Ques: What is DPIA full form?
Ans: The expanded form of DPIA is Data Protection Impact Assessment.

Ques: What is DPIA?
Ans: Data Protection Impact Assessment (DPIA) is a systematic process used by organisations to identify, analyse, and minimise security risks before launching new projects.

Ques: What does a completed DPIA example look like?
Ans: A completed Data Protection Impact Assessment (DPIA) is a structured compliance document showing where personal data lives, identified risks, the safeguards applied to each risk, confirmation of legal compliance, and a documented sign-off.

Ques: What is the difference between a DPIA and a PIA?
Ans: A PIA (Privacy Impact Assessment) is a tool used to evaluate general privacy risks in any project or system.
Whereas, a DPIA (Data Protection Impact Assessment) is a legally mandated process under the DPDP Act. This is mandatory for data processing activities carrying high-risk.

Ques: How to conduct DPIA?
Ans: A DPIA under the DPDP Act generally follows six steps: map the data, assess the risks, apply safeguards, check legal compliance, document the process, and monitor it over time.

Ques: Who is responsible for conducting a DPIA?
Ans: Only Significant Data Fiduciaries (SDFs) are legally required to conduct DPIAs annually. These SDFs can only be notified by the Central Government.

Ques: Is data audit and DPIA the same?
Ans: No, they are not the same. A DPIA is conducted to assess potential risk before a new processing activity, while a data audit reviews existing practices.

Ques: What happens if a company fails to conduct a required DPIA?
Ans: Non-compliance with the DPDP Act can result in penalties of up to ₹150 crore.

Ques: When does the DPIA become mandatory?
Ans: The Data Protection Impact Assessment (DPIA) requirement under India’s DPDP Act becomes mandatory on 13 May 2027.

The post DPIA (Data Protection Impact Assessment) Under the DPDP Act: What It Is and Why the 2027 Deadline Isn’t as Far as It Seems appeared first on DPDP.ai.

The Digital Personal Data Protection (DPDP) Act, 2023 does not require organisations to maintain a RoPA but maintaining it can help organisations better understand and manage their data processing activities. 

What is RoPA?

Records of Processing Activities (RoPA) is a structured record of what personal data an organisation collects and how it uses, shares and processes it. It gives a clear picture of an organisation’s data processing activities.

Organisations can use a spreadsheet, document, or privacy management platform for maintaining a RoPA. Keeping it organised helps teams to understand how personal data moves through the organisation and identify areas that need further privacy or compliance review.

Is RoPA required under the DPDP Act?

No, Digital Personal Data Protection (DPDP) Act does not require organisations to maintain a Record of Processing Activities (RoPA). This is different from the GDPR, in which Article 30 specifically requires certain organisations to maintain records of processing activities.

The DPDP Rules also place several responsibilities on Data Fiduciaries. While the Rules do not specifically require a RoPA, having a clear record of how personal data is processed can make it easier to meet these responsibilities, including:

• Giving Data Principals a notice with an itemised description of the personal data and the specified purpose.
• Applying reasonable security safeguards, including retaining processing logs for at least one year.
• Erasing personal data once its purpose is served, within the timelines.
• Notifying Data Principals and the Data Protection Board of a personal data breach.
• Carrying out Data Protection Impact Assessments and audits, if designated a Significant Data Fiduciary

What information should a RoPA include?

 Key information that can be included:

• Data Fiduciary: Entity which determines the purpose and means of the processing.
• Processing Activity: What the organisation is doing with the personal data. Purpose: Why the personal data is being collected and processed.
• Data Principals: The individuals whose personal data is being processed, such as customers, employees, or users.
• Data Sources: Where the personal data comes from.
• Systems and Applications: Where the data is stored or processed.
• Data Processors and Recipients: Third parties or service providers that receive or process the data.
• Retention: For how long the personal data is kept and when it should be deleted.
• Cross-Border Transfers: If the personal data is transferred outside India.
• Security Measures: The safeguards used to protect the personal data.
• Responsible Team: The department or the person responsible for the processing activity.

How to create a RoPA?

Creating a RoPA involves –

• Identify processing activities: Make a list of all the procedures related to personal information.
• Identify the data involved: Record what personal information is used, who is the owner of that data and the sources
• Document the processing: Record the purpose, systems, third parties, retention period, and other relevant details for each activity.
• Assign ownership: Identify the team or person responsible for each processing activity.
• Review the record: Go through the documentation with the relevant stakeholders and make sure that everything is accurate and complete.

How to maintain and update a RoPA?

Key practices include:

• Update after changes: Update the RoPA when you add a new system, processing activity, type of data, or third-party processor. 
• Assign responsibility: Give a specific person or team responsibility for keeping the RoPA updated.
• Use consistent formats: Use the same structure and terms throughout the RoPA so the information stays clear and easy to follow.
• Involve relevant teams: Get information from the teams that handle personal data directly.
• Review regularly: Check records periodically and update them when processing changes.
• Keep changes documented: Maintain a record of significant updates so changes can be tracked over time.
• Protect the RoPA: Restrict access to authorised users and protect the information it contains.

• Keep an audit trail: Track important changes to maintain accountability and visibility.

What are the benefits of maintaining RoPA?

There are some common benefits of maintaining RoPA.

• Accountability: A RoPA keeps a record of how personal data is handled and shows that the organisation is keeping track of its privacy practices. 
• Improves data visibility: Teams can see what personal data is being used, why it is needed, where it is stored, and who handles it. 

• Helps with third-party management: Makes it easier to keep track of processors and other third parties who are processing personal data and reviewing their relevant arrangements.
• Supports audits and reviews: Helps teams quickly provide accurate information during internal reviews, audits, or regulatory inquiries. 
• Supports security and risk management: Assists organizations to identify where personal data is processed so they can determine whether appropriate security measures and controls are in place. 
• Keeps compliance organised: Helps teams to find the gaps and update their records when the way they use personal data changes. 

What are the common challenges in maintaining a RoPA?

There are some common challenges in maintaining a RoPA.

• Changing how data flows: New systems, applications, and processes can change how personal data is collected and used.
• Incomplete information: The teams may vary in the amount of information provided to document their processing activities.
• Shadow IT: Applications or tools not formally recorded by the organisation may process personal data.
• Outdated records: Information can quickly become outdated if changes are not reflected in the RoPA.
• Manual effort: Maintaining records on spreadsheets or separate documents can be difficult to manage and might not be good for long term.

How can technology help manage RoPA?

Technology can simplify RoPA management by reducing manual work and keeping processing information organised in one place. It can help manage RoPA.

• Discover personal data: Identify personal data across databases, applications, cloud environments, and other systems.
• Map data processing: Connect data, systems, processing activities, and third parties to create a clearer view of data flows.
• Centralise RoPA records: Store processing information in one place instead of maintaining multiple spreadsheets and documents.
• Automate updates: Detect changes in data processing and update the records.
• Generate reports: Create reports for internal documentation, compliance and audit trails.

Conclusion

RoPA provides organisations with a structured way of keeping track of their personal data processing activities. The DPDP Act does not explicitly require a RoPA but having one can help in better managing privacy and compliance.

It is important to keep the RoPA accurate and up to date as data processing activities change. With the right processes and technology, organisations can better manage visibility of personal data, and better respond to privacy and compliance needs.

FAQs

Ques: What is the purpose of Records of Processing Activities?

Ans: The purpose of RoPA is to maintain a record of an organisation’s processing of personal data. It enables the team to have an understanding of the data that is collected, its application, its storage location and the responsible party.

Ques: What are the requirements for a RoPA?

Ans: A RoPA can include details such as processing activities, purposes, personal data categories, Data Principals, systems, processors, retention periods, cross-border transfers and security measures.

Ques: Why is RoPA important?

Ans: RoPA is important because it helps organisations maintain visibility over their personal data processing. It can also support privacy reviews, identify gaps and help manage DPDP compliance activities.

Ques: Is RoPA mandatory under the DPDP Act?

Ans: No. The DPDP Act does not specifically require organisations to maintain a RoPA. However, organisations can use it as a practical tool to manage and document their data processing activities.

Ques: How to start a RoPA?

Ans: Start by identifying all business activities that involve personal data. Then document the purpose, data involved, systems, third parties and other relevant details for each activity.

Ques: What are examples of RoPA?

Ans: There are some common examples of RoPA which include records for employee recruitment, customer onboarding, payroll, marketing, customer support, and vendor management. 

The post What Is RoPA? A Complete Guide to Records of Processing Activities Under DPDP appeared first on DPDP.ai.